Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
Detects export of credential or vault data from the Uniqkey organization. Exports are legitimate for backup and migration scenarios, but they move secrets outside the platform's protection and are the primary exfiltration vector for a password manager, so each occurrence is raised as its own alert for review. If scheduled exports by known administrative or service accounts create noise, exclude those actors in the query.
| Attribute | Value |
|---|---|
| Type | Analytic Rule |
| Solution | Uniqkey |
| ID | f3125212-6871-4adc-8335-98c9a920639b |
| Severity | Medium |
| Kind | Scheduled |
| Tactics | CredentialAccess, Exfiltration |
| Techniques | T1555 |
| Required Connectors | UniqkeyEventsConnector |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
UniqkeyEvents_CL |
? | ✓ | ? |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊